coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/railiance-backup-offsite-lane.md
tegwick ea98d6bf39
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
WARDEN-WP-0026 T01: capabilities-safe lane verification + incident note 
T01 (done): canonical capabilities-based verify pattern in the fleet promotion
checklist (catalog-lane-promotion.md) and applied to the railiance-backup and
forgejo-admin lane playbooks. Verification proves allow/deny via
`bao token capabilities` against the KV v2 data path, never `bao kv get`; a denied
default-policy token-create is a pass, not a privileged-fallback trigger.

T07 (progress): lessons-learned note for the 2026-07-16 CCR-2026-0004 disclosure
(three root causes). Live re-verify + rotation block remain (depend on T06).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 14:26:05 +02:00

2.8 KiB
Raw Blame History

Railiance Offsite Backup Lane

Date: 2026-07-07
Catalog: railiance-backup-offsite-lane (status draft, resolvable: false until verified)
Owner: railiance-platform (CCR-2026-0004)

Nextcloud WebDAV upload token and URL for age-encrypted offsite backups (Option A). Used by railiance-backup (workstation) and forgejo-backup (platform).

OpenBao pointers

Field Value
Mount platform
Path platform/workloads/railiance/backup/offsite-lane
Fields NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PRIVATE_KEY
Policy workload-kv-read-railiance-backup-offsite-lane
OIDC role railiance-backup-workload-kv-read (groups=net-kingdom-admins)

Worker checklist

  1. Login (caller identity — ops-warden adds no credential):

    bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read

  2. Export for a backup run (value streams to your shell — never paste into chat):

    export RAILIANCE_BACKUP_NC_TOKEN=$(
  bao kv get -field=NC_WEBDAV_TOKEN platform/workloads/railiance/backup/offsite-lane
)
export RAILIANCE_BACKUP_NC_WEBDAV_URL=$(
  bao kv get -field=NC_WEBDAV_URL platform/workloads/railiance/backup/offsite-lane
)

  3. Or proxy via warden access (after catalog promotion):

    warden access railiance-backup-offsite-lane --no-policy --fetch --field NC_WEBDAV_TOKEN

  4. Run backup:

    # workstation custodian DB + config
bin/railiance backup

# Forgejo production (from railiance-platform checkout)
tools/cmd/forgejo-backup

AGE_PRIVATE_KEY in the same path is recovery escrow — fetch only for restore drills.

Verify the lane (capabilities-safe — never read the value)

Prove allow/deny with bao token capabilities, not bao kv get. Reading the value to "confirm" it triggered the 2026-07-16 disclosure of NC_WEBDAV_TOKEN / NC_WEBDAV_URL / AGE_PRIVATE_KEY (see history/2026-07-16-credential-disclosure-lessons.md).

# Positive: lane OIDC identity can read the data path
bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
bao token capabilities "$(bao print token)" platform/data/workloads/railiance/backup/offsite-lane
#   → expect: read

# Negative: default-only identity is denied (no value is read)
DEFAULT_TOKEN=$(bao token create -policy=default -field=token)   # if this is denied, that IS the pass — do NOT fall back
bao token capabilities "$DEFAULT_TOKEN" platform/data/workloads/railiance/backup/offsite-lane
#   → expect: deny

The capability lists contain no secret material — safe to record on CCR-2026-0004 as promotion evidence. Full pattern: wiki/playbooks/catalog-lane-promotion.md#capabilities-safe-lane-verification.